{"record":{"id":"ATTACK:enterprise:T1087.002","title":"Domain Account","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1087/002","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--21875073-b0ee-49e3-9077-1e2a885359af","external_id":"T1087.002","domain":"enterprise","created":"2020-02-21T21:08:26.480Z","modified":"2026-05-12T15:12:00.622Z","version":"1.2","aliases":[],"tactics":["discovery"],"source_references":[{"source_name":"CrowdStrike StellarParticle January 2022","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"}]},"assertions":[{"id":"enterprise:relationship--0136018a-db45-4517-9834-7261488bc3fe","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0136018a-db45-4517-9834-7261488bc3fe","modified":"2026-04-29T14:23:05.904Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--09cc5150-b68e-45de-9172-5fec7623c9ac","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--09cc5150-b68e-45de-9172-5fec7623c9ac","modified":"2026-07-31T18:47:26.293Z","references":[{"source_name":"CrowdStrike StellarParticle January 2022","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"},{"source_name":"Secureworks IRON RITUAL Profile","url":"https://www.sophos.com/en-us/threat-profiles/iron-ritual"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0cf8d5da-a127-4b48-bbf9-e5a0376033b4","subject":"ATTACK:enterprise:S0516","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0cf8d5da-a127-4b48-bbf9-e5a0376033b4","modified":"2026-04-29T14:23:05.921Z","references":[{"source_name":"CISA SoreFang July 2016","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14612b22-b271-4e93-8f66-d86ce8e10c29","subject":"ATTACK:enterprise:S0039","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14612b22-b271-4e93-8f66-d86ce8e10c29","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Microsoft Net","url":"https://support.microsoft.com/en-us/help/556003"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16510fcf-70a0-4da5-9b80-f4772abca436","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16510fcf-70a0-4da5-9b80-f4772abca436","modified":"2026-07-31T18:48:30.408Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1685aa0e-d1be-40ea-ade0-21ff64e0d372","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1685aa0e-d1be-40ea-ade0-21ff64e0d372","modified":"2026-04-29T14:23:05.935Z","references":[{"source_name":"NCC Group Team9 June 2020","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"},{"source_name":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16c7058c-8fa5-4477-8332-9e76fcb38924","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16c7058c-8fa5-4477-8332-9e76fcb38924","modified":"2026-07-31T20:48:30.756Z","references":[{"source_name":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--182ae728-bd77-41ca-bd0d-dd2b3d6cf50b","subject":"ATTACK:enterprise:S0488","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--182ae728-bd77-41ca-bd0d-dd2b3d6cf50b","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"CME Github September 2018","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18cccfc2-e5a7-41ca-93ad-4ffef966b50b","subject":"ATTACK:enterprise:S1146","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18cccfc2-e5a7-41ca-93ad-4ffef966b50b","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e5c4c77-5e8b-4fe0-95f8-251f5a1f6fc0","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e5c4c77-5e8b-4fe0-95f8-251f5a1f6fc0","modified":"2026-07-31T18:48:08.296Z","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20710360-f3dd-4445-8a48-a2c905abdcdc","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20710360-f3dd-4445-8a48-a2c905abdcdc","modified":"2026-07-31T20:48:26.849Z","references":[{"source_name":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20f863a1-f7de-4d66-a564-c4adee24fdbe","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20f863a1-f7de-4d66-a564-c4adee24fdbe","modified":"2026-07-31T18:48:00.481Z","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--225f57e8-5001-4f20-b610-b62faf650fc9","subject":"ATTACK:enterprise:G1015","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--225f57e8-5001-4f20-b610-b62faf650fc9","modified":"2026-07-31T20:48:34.122Z","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source_name":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source_name":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2eb985a1-e73e-4554-8638-2e6f27690ec0","subject":"ATTACK:enterprise:S0018","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2eb985a1-e73e-4554-8638-2e6f27690ec0","modified":"2026-04-29T14:23:05.968Z","references":[{"source_name":"AlienVault Sykipot 2011","url":"https://www.alienvault.com/open-threat-exchange/blog/another-sykipot-sample-likely-targeting-us-federal-agencies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--313102fa-9545-46c9-84cd-74c6e29a5ad3","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--313102fa-9545-46c9-84cd-74c6e29a5ad3","modified":"2026-07-31T18:47:51.902Z","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--362e332d-7763-488d-b25d-f12965f56d62","subject":"ATTACK:enterprise:S0635","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--362e332d-7763-488d-b25d-f12965f56d62","modified":"2026-04-29T14:23:05.993Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3bad8943-4d47-4967-b2f4-c159c42a1eac","subject":"ATTACK:enterprise:G0030","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3bad8943-4d47-4967-b2f4-c159c42a1eac","modified":"2026-07-31T18:48:06.813Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"},{"source_name":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40527571-0b01-4568-b72b-568ad8b419ae","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40527571-0b01-4568-b72b-568ad8b419ae","modified":"2026-07-31T20:48:29.784Z","references":[{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44259d7d-e156-4e09-a401-ff62f0706cdd","subject":"ATTACK:enterprise:S0105","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44259d7d-e156-4e09-a401-ff62f0706cdd","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"TechNet Dsquery","url":"https://technet.microsoft.com/en-us/library/cc732952.aspx"},{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--493429f4-9d83-4131-8308-44e167a1a909","subject":"ATTACK:enterprise:G1032","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--493429f4-9d83-4131-8308-44e167a1a909","modified":"2026-07-31T20:48:47.641Z","references":[{"source_name":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e0775fd-17b6-44cd-9598-98f1a185b32b","subject":"ATTACK:enterprise:S1068","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e0775fd-17b6-44cd-9598-98f1a185b32b","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e2594cc-f6e0-4153-b878-930bc03fc0ad","subject":"ATTACK:enterprise:S0521","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e2594cc-f6e0-4153-b878-930bc03fc0ad","modified":"2026-04-29T14:23:06.032Z","references":[{"source_name":"CrowdStrike BloodHound April 2018","url":"https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5235ff3c-646a-4608-b90e-394bc2c54330","subject":"ATTACK:enterprise:G1004","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5235ff3c-646a-4608-b90e-394bc2c54330","modified":"2026-07-31T20:48:49.326Z","references":[{"source_name":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source_name":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54a5c9b4-7447-44fd-8aca-4162e6d51c85","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54a5c9b4-7447-44fd-8aca-4162e6d51c85","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"Cato LAMEHUG JUL 2025","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--57da83d5-2698-41b0-92b8-a92da8a4599c","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--57da83d5-2698-41b0-92b8-a92da8a4599c","modified":"2026-07-31T20:48:41.290Z","references":[{"source_name":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58b7b9bf-d09b-49f4-acf5-351979171317","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58b7b9bf-d09b-49f4-acf5-351979171317","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"},{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a6942dc-eab7-4f45-b5fa-6149774e2acc","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a6942dc-eab7-4f45-b5fa-6149774e2acc","modified":"2026-07-31T18:47:43.968Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b999234-d801-44c1-9436-319b3352d851","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b999234-d801-44c1-9436-319b3352d851","modified":"2026-07-31T18:48:25.559Z","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f5af879-c239-416b-99ec-b46e2f9926a2","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f5af879-c239-416b-99ec-b46e2f9926a2","modified":"2026-07-31T20:48:35.529Z","references":[{"source_name":"Palo Alto OilRig May 2016","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60f2ddcf-9b88-4a87-8baf-2777c9c49d39","subject":"ATTACK:enterprise:S0378","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60f2ddcf-9b88-4a87-8baf-2777c9c49d39","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"GitHub PoshC2","url":"https://github.com/nettitude/PoshC2_Python"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61dd6d75-a95b-488d-9a1d-924563592df7","subject":"ATTACK:enterprise:S0184","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61dd6d75-a95b-488d-9a1d-924563592df7","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63cda638-c359-470f-b509-446be108b607","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63cda638-c359-470f-b509-446be108b607","modified":"2026-07-31T18:48:14.120Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--689d5a99-cfcf-43d6-ae55-9bf920986f63","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--689d5a99-cfcf-43d6-ae55-9bf920986f63","modified":"2026-07-31T18:48:03.966Z","references":[{"source_name":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d55d9e0-34cb-43fe-bbd4-8dd2c88fec54","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d55d9e0-34cb-43fe-bbd4-8dd2c88fec54","modified":"2026-07-31T18:47:36.074Z","references":[{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7903f25e-388e-4cda-bd09-bc83fa64d62e","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7903f25e-388e-4cda-bd09-bc83fa64d62e","modified":"2026-07-31T18:47:28.368Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--800b5705-d504-41af-86cb-252c6b3e267f","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--800b5705-d504-41af-86cb-252c6b3e267f","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--82dee5a5-7890-4bed-bc8c-83ffa13a8bcf","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--82dee5a5-7890-4bed-bc8c-83ffa13a8bcf","modified":"2026-07-31T20:48:50.351Z","references":[{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source_name":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ac91e9e-447c-4def-9f4a-9c29c355c832","subject":"ATTACK:enterprise:S9037","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ac91e9e-447c-4def-9f4a-9c29c355c832","modified":"2026-04-29T14:23:06.114Z","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b425ec5-7be4-4225-a7c5-8f219fed7b6c","subject":"ATTACK:enterprise:G0117","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b425ec5-7be4-4225-a7c5-8f219fed7b6c","modified":"2026-07-31T18:48:17.380Z","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8baa00da-64da-4acb-831e-2c001399394a","subject":"ATTACK:enterprise:S0603","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8baa00da-64da-4acb-831e-2c001399394a","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d43c2da-0d5e-478a-aacb-b9da651854ce","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d43c2da-0d5e-478a-aacb-b9da651854ce","modified":"2026-07-31T18:47:31.755Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f1bdb28-7941-4b76-bcf3-2fe73321f0c5","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f1bdb28-7941-4b76-bcf3-2fe73321f0c5","modified":"2026-07-31T21:14:22.734Z","references":[{"source_name":"ESET Lazarus Jun 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--909db543-0968-4f02-b1d9-de64c0730c0a","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--909db543-0968-4f02-b1d9-de64c0730c0a","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94229aa6-c862-48b8-9959-1e1d3c04dd5e","subject":"ATTACK:enterprise:S0483","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94229aa6-c862-48b8-9959-1e1d3c04dd5e","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"DFIR_Quantum_Ransomware","url":"https://thedfirreport.com/2022/04/25/quantum-ransomware/"},{"source_name":"IBM IcedID November 2017","url":"https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--959c7695-01a5-4be1-9951-799749796cf4","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--959c7695-01a5-4be1-9951-799749796cf4","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"},{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9879a7e4-04b0-4cf2-a429-bad37bfd0741","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9879a7e4-04b0-4cf2-a429-bad37bfd0741","modified":"2026-07-31T20:48:32.075Z","references":[{"source_name":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ef08a26-d881-4a36-952b-c07808093c6b","subject":"ATTACK:enterprise:M1028","predicate":"mitigates","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ef08a26-d881-4a36-952b-c07808093c6b","modified":"2026-04-29T14:23:06.142Z","references":[{"source_name":"UCF STIG Elevation Account Enumeration","url":"https://www.stigviewer.com/stig/microsoft_windows_server_2012_member_server/2013-07-25/finding/WN12-CC-000077"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a602be33-6ed6-4f73-b7f6-10b47581707a","subject":"ATTACK:enterprise:G0033","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a602be33-6ed6-4f73-b7f6-10b47581707a","modified":"2026-07-31T18:48:05.216Z","references":[{"source_name":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6baf58a-f679-4ba7-abfd-4e1e67ad407b","subject":"ATTACK:enterprise:T1087.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1087","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6baf58a-f679-4ba7-abfd-4e1e67ad407b","modified":"2026-04-29T14:23:06.152Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab109b93-76a9-46da-8934-58751125fd1e","subject":"ATTACK:enterprise:S0165","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab109b93-76a9-46da-8934-58751125fd1e","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac6ce385-79d5-40bd-ab16-bd873fb1a821","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac6ce385-79d5-40bd-ab16-bd873fb1a821","modified":"2026-04-29T14:23:06.160Z","references":[{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8adb1db-0e1d-4f11-866b-de4dd5d31334","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8adb1db-0e1d-4f11-866b-de4dd5d31334","modified":"2026-10-01T20:58:13.781Z","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd71b4dd-c049-47d4-bd0c-04f3a36d23e2","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd71b4dd-c049-47d4-bd0c-04f3a36d23e2","modified":"2026-07-31T18:48:06.432Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d317032f-75dc-4d73-95ec-eabf3ed9d947","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d317032f-75dc-4d73-95ec-eabf3ed9d947","modified":"2026-07-31T18:47:48.117Z","references":[{"source_name":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4faeb90-07ee-4ae2-b77d-e002418d1b22","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4faeb90-07ee-4ae2-b77d-e002418d1b22","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d682570b-068d-421e-a6b4-a93640bd34dc","subject":"ATTACK:enterprise:S1022","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d682570b-068d-421e-a6b4-a93640bd34dc","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"CrowdStrike IceApple May 2022","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e45efac0-c894-4676-a503-d8c1aa0cb117","subject":"ATTACK:enterprise:G1053","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e45efac0-c894-4676-a503-d8c1aa0cb117","modified":"2026-07-31T18:48:03.987Z","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e506d4d7-c214-436c-a876-7ff2c71fcc87","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e506d4d7-c214-436c-a876-7ff2c71fcc87","modified":"2026-04-29T14:23:06.237Z","references":[{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e52c1bab-01f3-47c0-a5c9-361ba56d7e6a","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e52c1bab-01f3-47c0-a5c9-361ba56d7e6a","modified":"2026-07-31T18:47:41.510Z","references":[{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f451a96a-9266-4252-bd1f-d61c12691708","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f451a96a-9266-4252-bd1f-d61c12691708","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6cf6ad8-7a42-4cf5-82ab-45d6a5107aeb","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6cf6ad8-7a42-4cf5-82ab-45d6a5107aeb","modified":"2026-07-31T20:48:33.407Z","references":[{"source_name":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa155ccc-b9db-48f6-bb1a-a367596668ad","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa155ccc-b9db-48f6-bb1a-a367596668ad","modified":"2026-07-31T18:48:11.135Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa6f9dc7-e984-411a-9ce4-a822d4213bc6","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa6f9dc7-e984-411a-9ce4-a822d4213bc6","modified":"2026-07-31T20:48:28.808Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb21ff9d-1cd5-4908-a3a4-5f0d22cb8c10","subject":"ATTACK:enterprise:S0552","predicate":"uses","object":"ATTACK:enterprise:T1087.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb21ff9d-1cd5-4908-a3a4-5f0d22cb8c10","modified":"2026-04-29T14:23:06.266Z","references":[{"source_name":"Red Canary Hospital Thwarted Ryuk October 2020","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"},{"source_name":"FireEye Ryuk and Trickbot January 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source_name":"Symantec Bumblebee June 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"},{"source_name":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}